The author is a Forbes contributor. The opinions expressed are those of the writer.

Loading ...

Loading ...

This story appears in the {{article.article.magazine.pretty_date}} issue of {{article.article.magazine.pubName}}. Subscribe

Ryan McGeehan, Director, Security at Facebook

I've come to a firm belief that criminal organizations focused on electronic crime can be a source of important lessons for startups. These lessons are especially applicable to hiring decisions.

A well known fact in my industry is that bad guys make a lot of money in very short periods of time. We frequently joke about being in the wrong side of the industry, and about how much money we'd make breaking bad.

I was recently at a Cyber Crime conference in Barcelona. Presentations there revolved around electronic crime gangs, their profits, methods, and the investigations that eventually determine their fates in court. A rule of thumb: these gangs are usually pretty small, for reasons you can probably imagine.

Lets compare the thought process for hiring a strong engineer at a new startup with the same type of hiring for a criminal organization. A startup will evaluate a candidate based on things we're all familiar with. Work experience, education, leadership capability, ability to work as a team, and most importantly, their qualities as an engineer.

A criminal organization will similarly have all of these things under consideration, with the additional consideration that their addition to the conspiracy adds an incredible amount of risk. This new hire may turn on the others, may make a mistake and get caught, etc. Also, future skill sets cannot simply be hired. Everyone in the conspiracy must be willing to adopt new skills.

These additional considerations make hiring decisions much more serious for a criminal organization. Poor performance cannot be simply resolved with a termination, as this may put the entire conspiracy at risk. Any warm body added to the mix inherently adds complexities that would increase the chances of a game-ending mistake. With this limitation on headcount comes a specific laser focus on the ability to scale technologically. The result is that these teams do not grow much at all and focus almost entirely on building more efficient technology to achieve better results.

We frequently see conspiracies of broadly technical contributors in tiny, paranoid groups. Each participant in the conspiracy wears many hats as a software engineer, a PM, a system administrator, etc. They each bring several mission critical skillsets to their organization and take on diverse responsibility.

The conspiracy does not have the luxury of scaling the people in organization no matter how successful they become or how much capital they have to do it with. The only opportunity to scale is via their own skill sets, workflows, and technology. They must be extremely flexible.

As a result, I have found it very rare when gangs involve more conspirators than the lower single digits (not a strict rule by any means). This makes the focus on scale entirely technological and the individual contributors of a criminal organization must be in constant personal development. The foundation of this attitude is an expectation that they will never have support from new teammates and only have themselves to improve.

By the way, these jobs could be incredibly fulfilling if you're willing to suspend your ethics (or have none to begin with). Not to encourage cyber crime in any way, but it's healthy to be envious of it. It may even be the reason some choose that line of work, simply for the high value you would have on the team.

I speculate that criminal organizations could rank among the most efficient forms or organization due to this limitation, which pushes maximum individual contribution per conspirator. I have no data to support this, but I'll bet anyone a dollar it's true.

So how does this apply to a startup? Well ... I imagine it impossible to encourage a culture where engineers should have the expectation that they'll never have new teammates, similar to a criminal conspiracy. While it makes for a great headline, you probably don't want to outright hire engineers who have been involved with criminal organizations either.

A litmus test while interviewing may make for the simplest application of this lesson:

Would you hire this person you're interviewing for your criminal conpiracy?